Privacy policy
“What I know about you, what I use it for, and how to make me forget it. No tricks.”
1. DATA CONTROLLER
The data controller is Francisco Javier Nieto Vílchez, tax ID ES77437935V, with address at Avenida Santa Isabel 88, portal 1, 4C, Almería (Spain), contact email info@withcestral.com.
2. WHAT DATA WE PROCESS
- Account data: email address and password (stored encrypted, never in plain text) or, if you sign in with Apple or Google, the identifier, email address and name that account shares with us. If you use Apple’s option to hide your email, we only receive a forwarding address.
- Profile data: the name you choose, your gender if you state it, and your sign-up date.
- Training data: plan, sessions, sets, weights, reps, reps in reserve and records.
- Body data: weight, body fat, waist, muscle mass, body water and progress photographs, if you upload them.
- Device health data: sleep, steps, active calories and resting heart rate, only if you connect Apple Health.
- Conversations with the assistant, Leo.
- Minimal technical data needed for the app to work and to diagnose errors.
3. LEGAL BASIS
Account and training data are processed in order to perform the contractual relationship involved in providing you with the service (art. 6.1.b GDPR).
Body data, photographs and data from Apple Health are special category data concerning health: they are processed solely with your explicit consent (art. 9.2.a GDPR), which you give by entering them or by enabling the Apple Health connection. You can withdraw it at any time by disabling the connection or deleting that data from Profile, without affecting the lawfulness of processing carried out beforehand.
4. WHAT WE USE IT FOR
- Generating and adjusting your training plan and calculating your progression.
- Showing you your progress, your records and your body progress.
- Allowing the assistant to answer you and apply changes to your plan.
- Sending you reminders and notices, if you enable them.
- Maintaining the service, resolving incidents and improving it.
No decisions with legal effects are taken based solely on automated processing. Health data is not used for advertising purposes, nor sold or shared with third parties for those purposes, in accordance with Apple's HealthKit rules.
5. WHO ELSE PROCESSES IT
We work with providers acting as data processors:
- Supabase: database hosting, authentication and photograph storage.
- Google (Gemini models): processing of conversations with the assistant, Leo.
- Apple: operating system, HealthKit, notifications and Sign in with Apple.
- Google: Sign in with Google, if you choose it.
A data processing agreement as required by article 28 GDPR is in place with all of them.
6. INTERNATIONAL TRANSFERS
Some providers may process data outside the European Economic Area. Where that happens, the safeguards set out in Chapter V GDPR apply, such as the European Commission’s standard contractual clauses.
7. HOW LONG
We keep your data for as long as you keep the account. If you delete your data from Profile, your plans, sessions, records, measurements, photographs and health metrics are erased, and only the account is kept. If you delete the account, everything is erased, including the account itself, with no recoverable copy, except for anything we are legally required to keep. If you signed in with Apple, the access you granted the application from your Apple ID is also revoked.
8. YOUR RIGHTS
You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent, by writing to info@withcestral.com. You can exercise erasure rights yourself from Profile, immediately.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
9. SECURITY
We apply technical and organisational measures to protect your data, including encryption in transit, isolation of each user’s data through row-level access policies, and private storage for photographs, reachable only through temporary links.